The number of people purchasing products (e.g., goods and/or services) and executing financial transactions via the Internet has increased significantly over the course of the last several years. Many online enterprises have managed to attract and retain large customer bases resulting in significant growth and financial success. However, many successful online enterprises have not only drawn the attention of new customers, but they have also attracted unscrupulous persons seeking to defraud others.
One of the more common scams practiced by fraud perpetrators is referred to as “phishing.” Phishing involves sending an email to the users of a legitimate online enterprise and directing the users to visit a web site where they are asked to update personal information, such as passwords and/or credit card numbers, social security numbers, and bank account numbers, or any other number that may, or may not, already be on record with the legitimate enterprise. Both the email and the web site to which the user is directed are “spoofed.” That is, the email and the web site, commonly referred to as a spoof site, are purposefully designed to look as if they are from, or associated with, the legitimate online enterprise. However, in reality, the purpose of the phishing email is to direct the user to the spoof site, which exists for the sole purpose of stealing the user's personal information, such as the username and password associated with the user's account.
Once a fraud perpetrator has managed to steal the username and password associated with a user's account, the perpetrator will often access the user's account and commit some type of fraudulent activity. For example, if the account is associated with an online financial service provider, such as a bank, the perpetrator may transfer money out of the account and into a different account managed by the perpetrator. If the account is associated with an ecommerce enterprise, for example, such as an auction site, the perpetrator may list items for auction, or sale, and then accept payments for items with no intent of delivering the listed items.
To prevent fraud, many online enterprises attempt to track user activity in an effort to identify when irregular activity occurs. One of the ways that online enterprises attempt to track the activities of their users, including fraud perpetrators, is by tracking and analyzing the Internet Protocol (IP) addresses associated with client requests. However, as illustrated in connection with the network environment 10 shown in FIG. 1, detecting and/or tracking a perpetrator's fraudulent activities poses several challenges. Often, the fraud perpetrator accesses the enterprise server 12 that is hosting the online site from a client device 14 connected to the Internet 16 via an Internet service provider's (ISP) server 18. The ISP server 18 may dynamically assign IP addresses to several computers (e.g., client devices 20, 22, 24, 26, 28 and 30) including the perpetrator's client device 14. Consequently, it may be difficult for the online enterprise server 12 to track the perpetrator's IP address because the IP address may be different each time the perpetrator establishes an online session to access the online enterprise's server 12. Furthermore, the ISP server 18 may act as a proxy for the several client devices 20, 22, 24, 26, 28 and 30, by forwarding requests to the Internet using the ISP server's IP address (e.g., 212.12.12.1) rather than the IP address dynamically assigned to the client device making the request. Accordingly, the online enterprise server 12 may receive an extraordinary number of requests with the same IP address, for example, 212.12.12.1—the IP address of the ISP server 18.
To further complicate matters, in an effort to avoid detection, often a perpetrator will vary the way that he or she accesses the server 12 hosting the web site of a legitimate online enterprise. For example, as illustrated in FIG. 1, a fraud perpetrator using client device 14 may connect to the Internet 14 and access the online enterprise server 12 via any one of three ISP servers (e.g., servers 18, 32 or 34). Accordingly, one person may appear to the enterprise server 12 to be several people. Consequently, the online enterprise server 12 may have a difficult time tracking and detecting the source of fraudulent activity.